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LISTING OF THE CLAIMS : 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

1 (Currently Amended) A method for analyzing a potential cause of a change in a 
service, wherein service quality of the service is monitored, usage of the service is measured, and 
service events are detected, the method comprising: 

determining a service change time window based at least in part upon a change in service 
quality between a first working state and a second, non- working state, and upon a change in 
service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a plurality of detected events and a -corresponding t imes in 
which the events occurred; and 

computing a probability for each of the detected events that each of the detected events 
caused the service change based at least in part on a correlation between the event time and the 
service change time window. 

2. (Original) The method of claim 1, wherein determining the service change time 
window comprises determining a service failure time window based upon the change in service 
quality and narrowing the service failure time window to the service change time window based 
upon the service usage amount measured during that service failure time window. 

3. (Original) The method of claim 2, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
window as bounded by a polled point of the first working state and a polled point of the second, 
non-working state. 
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4. (Original) The method of claim 1, wherein computing the probability comprises 
computing the probability using at least in part a time weighting function which decreases 
exponentially with the distance between the event time and the service change time window. 

5. (Currently Amended) The method of claim 1, comprising determining whether one or 
more other events of a type identical to one of the detected events occurred, and wherein 
computing the probability comprises computing the probability using at least in part a false 
occurrence weighting function which decreases the probability of the detected event as the cause 
of the service change for instances in which the detected event occurred outside the service 
change time window. 

6. (Currently Amended) The method of claim 1, comprising storing historical data 
associating occurrences of prior events with prior service changes, and wherein computing the 
probability that one of the detected events caused the service change comprises computing the 
probability based at least in part on the historical data. 

7. (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events occurred within prior service change time 
windows, and wherein computing the probability that the detected event caused the service 
change comprises using at least in part a positive occurrence weighting function which increases 
the probability of the detected event as the cause of the service change based on instances in the 
historical data in which a prior event of a type identical to the detected event occurred within a 
prior service change time window. 

8. (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events were identified as having caused prior service 
changes, and wherein computing the probability that the detected event caused the service 
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change comprises using at least in part a historical weighting function which increases the 

probability of the detected event as the cause of the service change based on instances in the 

historical data in which a prior event of a type identical to the detected event was identified as 

having caused a prior service change. 

9. (Cancelled) 

10. (Currently Amended) The method of claim 10 9, wherein computing probabilities 
comprises computing the probabilities such that the total of all computed probabilities is 1. 

1 1 . (Currently Amended) The method of claim 1, wherein the service comprises service 
over a communication network and wherein the detected even ts include compris e s a network 
event. 

12. (Currently Amended) The method of claim 1, wherein the service comprises service 
provided by an application program and wherein the detected even ts include comprises an 
application program event. 

13. (Original) The method of claim 1, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service quality from the 
first working state to the second, non-working state. 

14 (Original) The method of claim 1, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service quality from the 
second, non-working state to the first, working state. 

1 5 (Original) The method of claim 1 , wherein determining the service change time 
window comprises detecting a change in service quality by detecting a step change in measured 
usage. 
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16 (Currently Amended) A method for analyzing potential causes of a service change, 
the method comprising: 

determining a service change time window encompassing a change of service between a 
first working state and a service outage, the service change being determined at least in part 
based on measured service usage levels; 

detecting occurrences of a set of events; 

retrieving data representing the plurality of detected events and corresponding times in 
which the events occurred, wherein the set of events are within a given time prior to and during 
the service change time window, each occurrence of an event being associated with a time at 
which the event occurred; and 

computing a probability distribution for the set of events, which probability distribution 
determines for each event in the set the probability that the detected event caused the service 
change, the probability distribution being based at least in part on relations between the time of 
each event occurrence and the service change time window. 

17. (Original) The method of claim 16, wherein computing the probability distribution 
for the set of events comprises computing the probability distribution using a first weighting 
function which is the product of two or more second weighting functions. 

18. (Original) The method of claim 16, wherein the two or more second functions are 
selected from the group consisting of: 

a time weighting function which decreases exponentially the probability of a given event 
as the cause of the service change with the distance between the given event time and the service 
change time window; 
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a false occurrence weighting function which decreases the probability of a given event as 
the cause of the service change for instances in which events of the same type as the given event 
occurred outside the service change time window; 

a positive occurrence weighting function which increases the probability of a given event 
as the cause of the service change based on instances stored in a historical database in which 
events of the same type as the given event occurred within a prior service change time window; 
and 

a historical weighting function which increases the probability of a given event as the 
cause of the service change based on instances in the historical database in which events of the 
same type as the given event were identified as having caused a prior service outage. 

19. (Original) The method of claim 1 8, wherein the step of computing the probability 
distribution comprises using a first weighting function which is the product of the time weighting 
function, false occurrence weighting function, positive occurrence weighting function, and user 
weighting function. 

20. (Original) The method of claim 16, comprising monitoring service quality, and 
wherein determining the service change time window comprises determining a service failure 
time window based upon a change in monitored service quality and narrowing the service failure 
time window to the service change time window based upon the service usage amount measured 
during that service failure time window. 

21 . (Original) The method of claim 20, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
window as bounded by a polled point of the first working state and a polled point of the second, 
non-working state. 
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22. (Original) The method of claim 16, comprising computing the probability 
distribution such that the total of all probabilities in the distribution is 1 . 

23. (Original) The method of claim 16, wherein the service comprises service over a 
communication network and wherein the detected events comprise network events. 

24 (Original) The method of claim 16, wherein the service comprises service provided 
by an application program and wherein the detected events comprise application program events. 

25 (Original) The method of claim 16, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service from the first 
working state to the second, non-working state. 

26 (Original) The method of claim 16, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service from the second, 
non-working state to the first, working state. 

27 (Previously Presented) The method of claim 16, wherein determining the service 
change time window comprises detecting a step change in measured usage. 

28 (Currently Amended) A network monitoring system comprising: 
a service monitor for monitoring quality of service on the network; 

a usage meter for measuring usage of the network; 

an event detector for detecting a plurality of network events and corresponding times at 
which the network events occur; and 

a probable cause engine, coupled to receive data from the service monitor, usage meter, 
and the event detecto r, the probable cause engine including a processing device that, in response 
to executable instructions, is operative tor ier-: 
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set setting a service change time window based upon data received from the 
service monitor or usage meter, the service change time window encompassing at least part of an 
occurrence of a service outage in the network; and 

determine d e termining which of the network events detected by the event detector 
is the most likely cause of a service change based at least in part of the relations of the d e t e ct e d 
n e twork event tim e s to th e servic e chang e tim e windo w including computing a probability for 
each of the detected events that each of the detected events caused the service change based at 
least in part on a correlation between the event time and service change time window . 

29. (Currently Amended) A computer readable medium storing program code for, 
when executed, causing a computer to perform a method for analyzing a potential cause of aan 
change in a service, wherein service quality of the service is monitored, usage amount of the 
service is measured, and service events are detected, the method comprising: 

determining a service change time window based at least in part upon a change in 
service quality between a first working state and a second, non-working state, and upon a change 
in service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a plurality of detected events and a -corresponding 
times in which the events occurred; and 

computing a probability for each of the detected events t hat each of the detected 
events caused the service change based at least in part on a correlation between the event time 
and the service change time window. 

30. -61. (Cancelled) 
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62. (Currently amended) Computer readable media comprising program code that, 
when executed by a programmable microprocessor, causes the programmable microprocessor to 
execute a method for analyzing potential cause of a service change, the method comprising: 

determining a service change time window encompassing a change of service between a 
first working state and a service outage, the service change being determined at least in part 
based on measured service usage levels; 

detecting occurrences of a sert of events; 

retrieving data representing the plurality of detected events and corresponding times in 
which the events occurred, wherein the set of events are within a given time prior to and during 
the service change time window, each occurrence of an event being associated with a time at 
which the event occurred; and 

computing a probability distribution for the set of events, which probability distribution 
determines for each event in the set the probability that the detected event caused the service 
change, the probability distribution being based at least in part on relations between the time of 
each event occurrence and the service change window. 

63 . (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
computing the probability distribution for the set of event comprises computing the probability 
distribution using a first weighting function which is the product of two or more second 
weighting functions. 

64. (Previously presented) The computer readable media comprising program code of 
claim 63 that, when executed by a programmable microprocessor, causes the programmable 
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microprocessor to execute a method for analyzing potential cause of a service change, wherein 

the two or more second functions are selected from the group consisting of: 

a time weighting function which decreases the probability of a given event 
as the cause of the service change with the distance between the given event time and the 
service change time window; 

a false occurrence weighting function which decreases the probability of a given 
event as the cause of the service change for instances in which events of the same type as 
the given event occurred outside the service change time window; 

a positive occurrence weighting function which increases the probability of a 
given event as the cause of the service change based on instances stored in a historical 
database in which events of the same type as the given event occurred within a prior 
service change time window; and 

a historical weighting function which increases the probability of a given event as 
the cause of the service change based on instances in the historical database in which 
events of the same type as the given event were identified as having caused a prior 
service outage. 

65. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, the 
method comprising monitoring service quality, an wherein determining the service change time 
window comprises determining a service failure time window based upon a change in monitored 
service quality and narrowing the service failure time window to the service change time window 
based upon the service usage amount measured during the service failure time window. 
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66. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, the 
method comprising computing the probability distribution such that the total of all probabilities 
in the distribution is 1 . 

67. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service comprises service over a communication network and wherein the detected events 
comprise network events. 

68. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service comprises service provided by an application program and wherein the detected 
events comprise application program events. 

69. (Previously presented) The computer readable media comprising program code of 
claim 62 that, when executed by a programmable microprocessor, causes the programmable 
microprocessor to execute a method for analyzing potential cause of a service change, wherein 
the service change is a service outage, comprising determining the service change time window 
as a change in service from the first working state to the second, non- working state. 

70. --77. (Cancelled) 
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